3

Just a few days ago the Windows Run As dialog started to popup when booting/logging into my Windows XP machine requesting the user with which to run "this program". How do I identify which program "this program" is?

enter image description here

AFAIK nothing has changed on my machine during this time. The only thing that I have done is connect a brand new SanDisk Sansa Clip Zip via USB which automatically installed the necessary drivers and all seemed to work OK.

I have so far hit Cancel on this dialog and everything appears to work normally.

I have looked in the System Event Viewer, but the only consistent item covering this time period seems to be a series of "Information" events under the "ACEEventLog" key. These are apparently to do with my ATI graphics card (Catalyst Control Centre) and from what I have Googled these are harmless. (?) However, I do find it puzzling that these only started appearing in the event log when the Run As dialog started popping up.

enter image description here

So, in summary, how can I find out what program is triggering the Run As dialog? And why?

Improve this question
5
  • 1
    Try disabling the (still two?) ATI services in services.msc. There should be a hotkey poller and another one.
    – Synetech
    Commented Jul 23, 2012 at 14:44
  • @Synetech Thanks for the tip regarding ATI services. I appear to have only one, ATI HotKey Poller (which I do not seem to require). I have disabled this, but I still get the Run As dialog at login and the events are still logged under ACEEventLog.
    – MrWhite
    Commented Jul 24, 2012 at 11:11
  • Then it is the CCC. You probably won’t need to modify your card settings every day (and can do so without having it built-into the system and constantly running anyway), so try using Autoruns to identify and disable the CCC startup program and if needed, even the shell-extension (in the Explorer tab).
    – Synetech
    Commented Jul 24, 2012 at 15:20
  • @Synetech My concern, however, is why the ATI drivers/software should suddenly be giving "problems" after having been installed and running perfectly OK for over 2 years?
    – MrWhite
    Commented Jul 25, 2012 at 20:29
  • 1
    Those are not errors, or else they would be red. Those are simply informational events (you’ll have to check the events to see exactly what they are notifying you about). Unnecessary informational events are not unusual for ATI; just be glad that you aren’t getting thousands of them (after six years, I gave up and learned to just live with/disable/clear them). To be honest, I don’t think the ATI events are related to the login prompt; it’s probably just a coincidence.
    – Synetech
    Commented Jul 25, 2012 at 21:14

9 Answers 9

Reset to default
4

Found elsewhere on the Net. http://forums.thinkbroadband.com/windows/4141498-how-to-disable-this-run-as-window-for-my-xp-please.html?fpart=all&vc=1

The theory is that Microsoft have changed something so that LG update software requires permission to run. I tried disabling lgfw.exe in my msconfig and it SEEMS to work. Of course if you don't have any LG hardware, some other manufacturer's update software could also be affected.

Improve this answer
2
  • Yes - this is exactly it! I have an external LG DVD writer (which I've had for over a year) and lgfw.exe is run from HKLM\...\Run. This is largely unnecessary (although bizarrely I think there was a firmware update just the other week!). I've disabled it in Autoruns. After your first post (before the edit) I had actually found the same page and a very useful tip...
    – MrWhite
    Commented Jul 28, 2012 at 12:11
  • To find out what program is trying to "Run As": 1. Leave the "Run As" dialog open. 2. Open Task Manager. 3. Under the "Applications" tab right click on the Task "Run as". 4. Select "Go To Process".
    – MrWhite
    Commented Jul 28, 2012 at 12:15
2

Try scheduled tasks - you may get lucky with all the details there.

Or, type in msconfig into Run (on XP) and see if there is anything strange there (in the startup tab).

Or, when your "Run As" window is open, open task manager - there could be an insight?

Is the Sandisk plugged in on boot? If so, unplug it and try the boot, see if that is the issue?

Improve this answer
5
  • @Synetech - I don't understand. You can easily have programs starting which only run when logged on - therefore not needing username and password.
    – Dave
    Commented Jul 23, 2012 at 14:34
  • I suppose that makes sense; I don’t use the Task Scheduler. In fact, if it is a task that was created with a program’s installer (or worse), I imagine it would not have the login credentials available to add to the task. Incidentally, Autoruns shows tasks as well, so it’s a one-stop-shop.
    – Synetech
    Commented Jul 23, 2012 at 14:42
  • I don't have much in scheduled tasks, and nothing recent that would seem to cause this. I had glanced over msconfig previously, but I am now comparing the msconfig-listed start programs with task manager running processes to see if I can spot any anomalies. The SanDisk (mp3 player) is not connected on boot.
    – MrWhite
    Commented Jul 24, 2012 at 11:15
  • If you're unsure about this, I would check out cthart answer in this post - the program he suggests may save you time.
    – Dave
    Commented Jul 24, 2012 at 11:50
  • "when your "Run As" window is open, open task manager" - Yes! I have since found that from the "Applciations" tab, right click on the "Run As" task and select "Go To Process".
    – MrWhite
    Commented Jul 28, 2012 at 12:20
2

Use Autoruns to see a list of things that get started automatically at boot and login.

If you can’t figure it out I think you can generate some kind of log or output and post that here—or even a screenshot.

I wonder if the "Sansa Clip Zip" has installed some software?

Improve this answer
2
  • Thanks for the Autoruns tip. I guess it is possible the Sansa Clip Zip has installed something - can USB devices do this? Windows did the usual "Installing new hardware" when the Sansa Clip Zip was first connected via USB. It behaves just like a standard external drive (two in fact - one for the internal memory of the device and one for the additional MicroSD card). The only slight oddity I find is that when you connect the device, it automatically opens an Explorer window (one for each internal and MicroSD card) showing the device contents. Normal USB storage devices don't appear to do this?
    – MrWhite
    Commented Jul 24, 2012 at 11:57
  • @w3d, if you have Autoplay enabled, then yes, a USB device could automatically run a program. It is usually advised to disabled Autoplay, even if you don’t plug in random drive you find on the street.
    – Synetech
    Commented Jul 24, 2012 at 15:21
2

If you can't see the rogue app in Task Manager because it only lists 1 app (i.e. RunAs) in the 'Applications' tab, try the following;

  1. RunAs using an Administrator account that is not currently listed in the 'User Name' column in the 'Processes' tab. NB: Create a new temporary account if necessary, then log into it and choose to RunAs your normal username, which I'm assuming has admin rights.

  2. Now look at the Task Manager, 'Processes' tab for a row with the RunAs account in the 'User Name' column.

  3. When you find it, that's the rogue that's causing the problem.

  4. Suggest typing the 'Image Name' into Google to find out what it is...

Improve this answer
1

Try making a new standard user (hopefully limiting access the program gains if you're concerned about that) and running the program as this new user. Then go find the only processes that is running as said user. Might be easier than digging through your system for it.

Improve this answer
1

I have EXACTLY the same problem as this guy. I am a gamesplayer and just run XP as plain-vanilla as possible. A week or so ago, the 'Run As' box started popping up every time I boot my PC. I know that I am not 'answering' his question but I hope I'm providing some corroboration.

I did a System Restore to July 11th and that got rid of it for a while but obviously I cannot avoid updating my PC.

I tried the registry hack of creating a D-word to hide RunAsVerb (whatever that is) but that only worked for a while.

I have gone through msconfig removing everything that doesn't seem useful.

I have disabled 'RunAs' (checked and it is still disabled) but the 'Run As' problem has just returned.

I HAVEN'T connected a SANDisk to my PC or anything else during this period.

Improve this answer
2
  • The other (unfortunate) possibility is that you have malware/virus that is attempting to run with elevated privileges?! Thanks for the corroboration, but I think there could be a number different reasons that could trigger this Run As dialog. I'm sure that disabling/hiding "Run As..." won't resolve the underlying the problem. (NB: This should really be a comment... if you had enough (50) reputation.)
    – MrWhite
    Commented Jul 24, 2012 at 18:32
  • After a day of fiddling I have again used System Restore and the problem is no longer present. I tried the Symantec on-line virus checker, which found nothing, but I noticed that I had a process called pcCMService present, which some sites are saying is a 'rootkit' which is not detected by virus checkers. The problem seems to return if I run Windows Update and patch up, but at the moment the process is not present.
    – beresford
    Commented Jul 25, 2012 at 18:36
1

The way I found out what program was causing this message was to start Task Manager and see what programs were running. There were two listed - one was "run As" and the other was "LGFW". So I looked around the net for "LGFW program" and found the answer.

Improve this answer
0

The same was happening to me. Every boot brought the "Run As" box up. Solved it by checking my startup list from "Run" msconfig. An update recently started calling an exe file to stat at boot. In my case it was from an LG drive I have. It can be stopped by disable the startup in the msconfig, or removing the program in your program files.(ie. "C:\Program Files\lg_fwupdate\lgfw.exe"blrun)

Improve this answer
-1

you want to get rid of the runas dialog box that pops up when you start your computer on desk top, it's easy start your computer go to desk top when runas dialog box pops up, push Ctrl & alt and delete buttons all at the same time, windows task manger will come up look at Applications that are running you will see in applications runas will be at the top and the program that's making runas start will be below it. write the name of the program below runas on some paper so you won't for get it, close windows task manager. now go to start at the bottom left hand Conner and click on it, go to search, for files & folders in the file search box, type the program name you wrote down and hit search when the program comes up click on it with your right button on your mouse and delete that program, close restart your computer and the runas box will be gone, why does that work, that program is not compatible with XP, that's why runas box comes up.

Improve this answer
1
  • 1
    Runas run as explorer.exe. So, using your approach is not possible.
    – Braiam
    Commented Dec 8, 2013 at 13:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .